Created attachment 647343[details][diff][review]
patch
The assertion is getting upset because nsSVGOuterSVGFrame implements nsISVGChildFrame. The assertion should just check for the NS_FRAME_SVG_LAYOUT bit instead of nsISVGChildFrame.

Comment on attachment 647343[details][diff][review]
patch
[Approval Request Comment]
The real bug we want to fix on aurora is bug 779403, but that bug depends on the fix in bug 768351, which in turn depends on the fix in this bug, so requesting approval on this patch.
Bug caused by (feature/regressing bug #): 738192
User impact if declined: SVG masking is broken
Testing completed (on m-c, etc.): patch has been on m-c for several days
Risk to taking this patch (and alternatives if risky): none
String or UUID changes made by this patch: none

Err, for "Risk to taking this patch (and alternatives if risky)" I seem to have only processed the "alternatives" part. The risk is very low though, but yeah, there aren't really any viable alternatives.